Executive brief
RustDesk Client, a remote desktop application used for accessing computers over a network, contains a vulnerability in how it processes server-sent instructions. An attacker who can impersonate or redirect the client to a rogue management server can remotely disable the RustDesk service on the victim's machine. This results in a denial-of-service, preventing legitimate users from accessing the device remotely and potentially disrupting business operations.
Technical details
A vulnerability exists in the RustDesk Client's heartbeat synchronization loop and strategy processing modules (specifically src/hbbs_http/sync.rs). The client fails to sufficiently verify the authenticity of 'strategy' payloads received from the API server. An attacker who successfully performs a Man-in-the-Middle (MitM) attack or redirects a client to a rogue API server can inject a 'stop-service' instruction. Because the client merges these unauthenticated strategy options with higher priority than local user settings, it will execute the 'stop-service' handler, leading to a remote denial-of-service. This affects clients on Windows, MacOS, Linux, iOS, and Android.
Affected products
- RustDesk RustDesk Client through 1.4.8
Timeline
- 2026-03-05: disclosed: Initial vulnerability discovery and documentation by VULSec Labs
- 2026-06-22: advisory: Updated advisory confirming the vulnerability persists in version 1.4.8